CVE-2021-25067: Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS)

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-17 · updated 2026-06-17
Weakness: CWE-79

Description

The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.

Affected products

Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages: before 1.4.9.6 — fixed in 1.4.9.6

How to fix

Upgrade to a fixed version: Landing Page Builder – Lead Page – Optin Page – Squeeze Page – WordPress Landing Pages 1.4.9.6. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/365007f0-61ac-4e81-8a3a-3a068f2c84bc
https://wpscan.com/vulnerability/365007f0-61ac-4e81-8a3a-3a068f2c84bc

Get alerted when CVE-2021-25067 or the next vulnerability affects your stack